Law enforcement agencies increasingly rely on social media data to perform criminal investigations. An agency typically serves a search warrant, national security letter, subpoena, or another type of legal process on a social media platform administrator which provides a legal process return to the agency in response to the legal process. Legal process returns may be provided as electronic data files in a number of formats including, for example, PDF files, text files, spreadsheets, and database files. They can include information such as, for example, contact information, friend lists, private messages, public posts, “tag” and “like” or “favourite” history, phone numbers, login history, and IP address information.
Problems arise when a legal process return is received as an electronic data file that includes unstructured data. The unstructured data, for example, may need to be manually processed by law enforcement agencies in order to aggregate the data and produce useful reports. Such manual processing may require significant amounts of time to accomplish (e.g., weeks or months) and can reduce the value of the acquired information, as the information may become stale or irrelevant during that time. Moreover, the size of unstructured electronic data files can make it difficult or impossible to view the files using native files viewers. For example, legal process returns that include unstructured data can include several hundreds of thousands of pages of data. These electronic data files may exceed sizes of 500 Mb, making it impossible for agencies to view and search the files on conventional data management systems.